Tag Info

Hot answers tagged

8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


6

Depends on what you're comfortable doing; when starting to "professionalize" our office network for a similarly sized business, I set up a pfSense Firewall behind our modem, and assigned it routing tasks for the office. All you need is a machine to dedicate with a few NICs and you're on your way. It's pretty well documented online, and I haven't had an ...


6

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


5

Discovered that the problem was that I had special characters in my password. There was never any indication that special characters were not permitted, but sure enough, when I reset the password to something alphanumeric, it works.


5

You can simplify the solution... If you're looking for a way to link all of these servers (not routers or gateways devices) as though they were on one flat network, I'd suggest looking at the n2n peer-to-peer offering from ntop. This tool allows you to traverse intermediate devices; helpful if you don't have access to firewalls or have complex routing ...


5

Yes, there is. Configure your local resolver to be your local bind (nameserver 127.0.0.1 in /etc/resolv.conf), then tell your local nameserver that it is locally-authoritative for .dev (as you already are); that .vpn is a special TLD, queries for which should be sent to a custom DNS server; and that all other queries should go to your ISP. This is the sort ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


4

According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel. And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s. So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so ...


4

Any thoughts? Don't do this. Either configure a client-based VPN connection for each host that you want to connect with, or configure a site-to-site VPN and bridge both sites in question. Windows 7 was not ever intended to be used the way that you're describing.


4

The Cisco AnyConnect client will not even install if you have Internet Connection Sharing (ICS) enabled. It's not supported at all. Get a firewall and set up a site-to-site VPN.


4

Keeping port 22 open is no less secure than keeping port 80 open on your web server as long as you are using public key authentication or secure user passwords. Many security practices are unfounded myths. It's unlikely that severe exploits exist in sshd. Why is the VPN server's port suddenly more secure than the SSH port? Just verify your SSH public key ...


4

IPsec in transport mode would do this, but this really isn't scalable. Four nodes is about the most at which I would even think about it. I'm currently using strongSwan for IPsec on Linux, which is easy enough to set up this way. Since you edited your question and changed the requirements a bit, I'm going to recommend you take a look at Open vSwitch ...


4

What you don't want is a VPN. What you do want is indeed IPsec, but not in tunnel mode. Rather, you want IPsec in transport mode. In this configuration, each host communicates directly to its peer, and only packet payloads are encrypted, leaving IP headers in place. This way, you don't need to do any routing gymnastics to get things working. Yes, you'll ...


3

What about putting it in bridged mode, and using your own router to see if the problem still happens. My guess some kind of problem in the routing side of things, persistent NAT? Anyway, just about no one that I know uses carrier provided gear, mainly for security and manageability concerns. Even if you get something else, you should consider something ...


3

In the SSLVPN adapter, in TCP/IP properties, DNS, make sure Register this connection's addresses in DNS actually checked. Often on a VPN connection it isn't...


3

Your clients are not registering their IP addresses with DNS for the simple reason that they're not configure to, when connecting to the VPN. This behavior is called Dynamic DNS Registration, and in Windows, is a per-network adapter setting. Through the GUI, you'd enable or disable this on the network adapter Properties, the Networking tab, TCP/IP ...


3

You could use OpenVPN. If you use a OpenVPN server listening on port 443, it will probably not be filtered. However, people analyzing your network traffic will know that you are using OpenvPN: you might want to avoid this. If you want to avoid this, you could connect to the OpenVPN server through a HTTPS proxy. OpenVPN knows how to use a HTTP proxy but not ...


3

When I am not on VPN, where is "how" or "where" is my connection being refused ? The corporate firewall. The firewall sees a request to connect to a restricted address (the server) from an unapproved address (your laptop's public IP) and rejects it. When I am on VPN, my connection is to a corporate VPN server. How does the "server" understand ...


3

I use netcat, you can download the windows version here On one end of the VPN start a listener (-l for listen -u for UDP): nc -lu <port> On the other end test the UDP connection, text entered after issuing the nc command should appear on the listener terminal: nc -u <litenerIP> <port> here's a local test run in 2 separate terminals: ...


3

Adding GRE to Amazon Security Group is very easy but somewhat hidden. In your case, to allow PPTP VPN inbound connection to EC2 instance, create a rule in Security Group as follows: Select "Custom protocol rule" in the "Create a new rule" drop-down menu. Enter "47" in the "Protocol" field. Enter CIDR (IP range) for the clients subnets (for testing only, ...


3

The level of security is high because it allows access to your remote network. If it was automated then it wouldn't be a security measure. Don't try to circumvent it, go see your admin and talk about whether that level is appropriate.


3

It has to do with permissions. Run is as an administrator with the UAC disabled and it will work. You have to disable the UAC. Or you can run the VPN as a service, and it will connect and add routes correctly. compatibility mode Those won't make a difference.


3

Despite being an old question I stumbled here and I can see a lot of speculation here. The other answers are likely correct to some extent, but I believe it misses the crucial factor for the situation experienced by the asker. VPN uses compression. I'm using LZO-compression and that will improve my speeds up to 4x compared to the connection width. This is ...


3

Simply buy more CALs from Microsoft.


3

Change your nmap to 172.16.0.5 instead of localhost or change the --local option on the openvpn command line or config. By default, openvpn should listen on all interfaces for udp/1194. nmap -sU localhost -p 1194 Starting Nmap 5.21 ( http://nmap.org ) at 2013-11-14 04:14 EST Nmap scan report for localhost (127.0.0.1) Host is up. PORT STATE ...


3

Your VPS does not support iptables, you will have to get your host to enable it for you. Alternatively get a VPS based on KVM or similar rather than containers like OpenVZ.


3

It sounds like the printer isn't configured with a default gateway. In that scenario your ping requests from "Network A" will travel to "Network B" to the printer. The printer, having no default gateway configured, won't be able to respond back to "Network B" because, without a default gateway configured, it has no ability to send packets to subnets other ...


3

10.8.2.12 sees 10.8.2.254 as being on the same subnet, therefore it's requesting the MAC address of 10.8.2.254 to insert it as a dest MAC in future packets to 10.8.2.254. Since 10.8.2.254 doesn't exist, no one is replying and 10.8.2.12 never finds out what MAC to set as the dest MAC. Try using proxy_arp on your main server. echo 1 > ...


3

Setting up a VPN can be pretty easy, many routers have some built-in VPN functionality already. VPN is a broad topic and we don't know what your needs and constraints are, because you didn't tell us. You should probably hire a consultant to help you get it set up and find out what your needs and constraints are; this shouldn't be a service that you pay for ...


3

Windows supports SSTP, L2TP, and PPTP, as well as DirectAccess (with Enterprise SKUs). No OpenVPN support here, you need to use the OpenVPN client for that.



Only top voted, non community-wiki answers of a minimum length are eligible